The article tackles the issue of personal data protection in case of tracing (looking for) individual persons who have been exposed to health risks pursuant to the EU Decision 1082/2013 on Serious, Cross-border Health Threats. This problem exemplifies just one among many challenges of the health-security nexus in the EU. That is, it regards a certain trade-off between the limitation of individual rights and securing populations’ safety. The text appraises the safeguards for the (lawful) limitation of the right to data protection after an in-depth examination of the provisions of the Health Threats Decision, its implementing measures, the reports on its operation, and in light of the general EU data protection laws. In conclusion, it claims that a number of improvements are needed because of the incompleteness, and the insufficient coherence and transparency of the EU regime for health threats. The established shortcomings are, at least in part, caused by the new EU “integrated approach” to health and security. In effect, an overall philosophy of reforms of public health policy in the name of “all-hazards security” applied in the Health Threats Decision can result in a reduction of the adequate level of protection of individuals’ personal data.

Currently, there is ongoing discussion about the role of regulatory oversight bodies in relation to the implementation of regulatory impact assessments (RIAs). In fact, one can witness a diffusion of regulatory oversight systems, including in CEE countries, where introduction of an RIA oversight body became part of the modernisation of the overall RIA process to become more effective. In fact, the regulatory oversight mechanism is seen as a tool for the instrumental role of regulation governance. However, this approach does not adequately explain the rationale behind setting up such a body; strategic and symbolic roles may be significant as well. This article first compares the manner in which oversight mechanisms have been institutionalised in five Central and East European countries: the Czech Republic, Estonia, Hungary, Slovakia and Slovenia. Second, it explores how differences in institutionalisation and operation shed light on understanding what stakeholders expect and understand in relation to control of RIA quality. The paper concludes that there are marked differences in regulatory oversight set-up and roles across Central and Eastern Europe, notably as a consequence of the presence or absence of internal learning.

Modern financial regulation has predominantly been economically-driven,1 progressing from addressing market failures to making markets more competitive and work better.2 The UK Financial Conduct Authority is expressly mandated to pursue regulatory objectives that maintain market integrity and protect consumers (addressing market failures) and to promote competition (making markets work better).3 Both the FCA and its sister regulator, the Prudential Regulation Authority (for banks), have recently adopted innovative regulatory initiatives to promote technologically-driven innovation, aimed at making markets work better. These initiatives are also a response to the recent explosion of technologically-led financial innovation outside of the regulatory perimeter.

In promoting financial innovation, we argue that the regulators have insufficiently focused on the need to govern financial innovation more generally. Although this concern may seem premature, the regulatory innovations are increasingly extending the perimeter for regulatory oversight of financial innovations. As the regulatory innovations have the potential to develop into more mature regulatory frameworks for governing financial innovation, we argue that regulators should manage the risks of their current approach and develop a regulatory strategy framework for balancing regulatory objectives and developing regulatory policy. We propose a framework anchored in rationality, consistency and accountability in governing financial innovation.

Joined Cases C-78/16 and C-79/16, Giovanni Pesce (et al) v Presidenza del Consiglio dei Ministri, [2016] EU:C:2016:428.

In Xylella, the Court of Justice of the European Union (CJEU) was called upon to assess how far policymakers can go in conditions of scientific uncertainty, and whether EFSA opinions can be indirectly subject to judicial review, despite not being legally binding. In particular, the Xylella case highlights the relevance of EFSA’s scientific authority over the Commission: since EFSA opinions are not directly reviewable by the CJEU – as they constitute an intermediate stage of a more complex administrative procedure – the political and legal liabilities relating to EFSA assessments are entirely shifted onto the Commission, whose discretion is reviewable by the EU judiciary. In this regard, the Xylella case confirms how difficult the judicial review of precautionary measures can be. It shows once again that a full assessment of these measures is impossible, as scientific uncertainty restricts the grounds for judicial review to the manifest appropriateness of the contested measures and the availability of less onerous and equally effective measures.

For nearly three decades scholars have studied issues of EU risk regulation, first presented as regulation of safety of products and persons,1 later on as true issues of risk regulation. This short comment will give brief, and at times personal, insights into the development on scholarly thinking on EU risk regulation and sketch a few challenges for the future.